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DECISION ON APPEAL 
Appellants appeal under 35 U.S.C. § 134 from the Examiner's 
rejection of claims 1-10, 12-23, 25-28, 30, and 31. We have jurisdiction 
under 35 U.S.C. § 6(b). 
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STATEMENT OF THE CASE 
Appellants invented a network security management system that 
prevents viruses or other malicious code from overwriting or altering critical 
files. Initially, factors associated with a computer are identified. Then, 
requests to write to files on the computer are monitored. The writes to the 
files are conditionally prevented based on the factors to prevent virus 
proliferation. In addition, the factors are altered based on the monitoring of 
the requests.' Claim 1 is illustrative: 

1 . A method for preventing writes to critical files, comprising: 

(a) identifying factors associated with a computer; 

(b) monitoring requests to write to files on the computer; and 

(c) conditionally preventing the writes to the files on the computer 
based on the factors to prevent virus proliferation; 

(d) wherein the factors are altered based on the monitoring of the 
requests to write to the files on the computer; 

(e) wherein the factors are updated based on the requests. 

The Examiner relies on the following prior art references to show 
unpatentability: 

Stevens US 2002/0133702 Al Sep. 19, 2002 

(filed Mar. 16, 2001) 

Rickey US 2002/0166059 Al Nov. 7, 2002 

(filed May 1,2001) 

Description of the Windows 2000 Windows File Protection Feature 
(Q222193), Microsoft Personal Online Support, available at 
http://web.archive.org, Jul. 8, 1999 ("WFP"). 

' See generally Specification 1:6-4:27. 
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The Examiner's rejections are as follows: 

1. Claims 1-7, 9, 10, 12-20, 22, 23, 25-28, and 30 are rejected under 35 
U.S.C. § 103(a) as unpatentable over WFP in view of Rickey.^ 

2. Claims 8, 21, and 31^ are rejected under 35 U.S.C. § 103(a) as 
unpatentable over WFP in view of Rickey and further in view of 
Stevens. 

Rather than repeat the arguments of Appellants or the Examiner, we 
refer to the Briefs and the Answer for their respective details. In this 
decision, we have considered only those arguments actually made by 
Appellants. Arguments which Appellants could have made but chose not to 
make in the Briefs have not been considered and are deemed to be waived. 
See 37 C.F.R. § 41.37(c)(l)(vii). 

OPINION 

It is our view, after consideration of the record before us, that the 
evidence relied upon and the level of skill in the particular art would have 
suggested to one of ordinary skill in the art the invention set forth in claims 
1-10, 12-23, 25-28, and 30. We reach the opposite conclusion, however, 
with respect to claim 3 1 . Accordingly, we affirm-in-part. 

We first consider the Examiner's rejection of Claims 1-7, 9, 10, 12- 
20, 22, 23, 25-28, and 30 under 35 U.S.C. § 103(a) as unpatentable over 
WFP in view of Rickey. In rejecting claims under 35 U.S.C. § 103, it is 

^ Although the Examiner includes claims 1 1 and 24 in the rejection (Answer 
3), these claims have been cancelled. See Br. 5 and Claims App.; see also 
Answer 3 (acknowledging copy of appealed claims as correct). 
^ Claim 31 was rejected under a new grounds of rejection to correct a defect 
in a previous rejection of the claim (Answer 2-3). 
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incumbent upon the Examiner to establish a factual basis to support the legal 
conclusion of obviousness. See In re Fine, 837 F.2d 1071, 1073, 5 USPQ2d 
1596, 1598 (Fed. Cir. 1988). In so doing, the Examiner must make the 
factual determinations set forth in Graham v. John Deere Co., 383 U.S. 1, 
17, 148 USPQ 459, 467 (1966). Furthermore, "'there must be some 
articulated reasoning with some rational underpinning to support the legal 

conclusion of obviousness' [HJowever, the analysis need not seek out 

precise teachings directed to the specific subject matter of the challenged 
claim, for a court can take account of the inferences and creative steps that a 
person of ordinary skill in the art would employ." KSR Int'l Co. v. Teleflex 
Inc., No. 04-1350, slip op. at 14 (U.S., Apr. 30, 2007) (quoting /« reKahn, 
441 F.3d 977, 988, 78 USPQ2d 1329, 1336 (Fed. Cir. 2006)). 

If the Examiner's burden is met, the burden then shifts to the 
Appellants to overcome the prima facie case with argument and/or evidence. 
Obviousness is then determined on the basis of the evidence as a whole and 
the relative persuasiveness of the arguments. See In re Oetiker, 977 F.2d 
1443, 1445, 24 USPQ2d 1443, 1444 (Fed. Cir. 1992). 

Regarding independent claims 1, 14, and 27, the Examiner's rejection 
essentially finds that WFP teaches every claimed feature except for 
preventing writes to the files to prevent virus proliferation. The Examiner 
cites Rickey as teaching that viruses can enter a system via critical files. The 
Examiner concludes that it would have been obvious to one of ordinary skill 
in the art at the time of the invention to use WFP's method of blocking 
writes to files to prevent viruses from entering the system (Answer 4). 
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Regarding claims 1, 2, 4-7, 13-15, 17-20, 26, and 27,"* Appellants 
argue that WFP does not disclose altering factors based on the monitoring of 
the requests to write to files on the computer as claimed. Appellants 
emphasize that WFP's system determines if a file has already been modified 
and, if so, WFP restores the modified file to the correct version. That is, the 
file is updated after being modified. According to Appellants, WFP's 
updating a modified file does not teach or suggest preventing writes to files 
on a computer, let alone altering factors based on monitoring of the requests 
or updating the factors based on the requests as claimed (Br. 9-10; Reply Br. 
3-5). 

The Examiner argues that the critical files in WFP are the claimed 
factors. The Examiner notes that whenever a file is modified, a "write call" 
- and therefore a corresponding write request - occurs in the system. 
Therefore, WFP monitors write requests as claimed. The Examiner fiirther 
notes that when WFP replaces a modified file with the correct version, the 
file (i.e., factor) is altered based on the modification (i.e., write request) 
(Answer 7-8). 

We will sustain the Examiner's rejection of representative claim 1. 
Althougji WFP restores modified files to their correct versions as Appellants 
indicate, Appellants' arguments are simply not commensurate with the scope 
of the claim. 

First, the limitation calling for "factors associated with a computer" is 
fiilly met by particular file versions in WFP giving the term 



^ Appellants designate these claims as corresponding to Group #1 (Br. 9). 
We therefore select claim 1 as representative of claims corresponding to this 
group. See 3>1 C.F.R. § 41.37(c)(l)(vii). 
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"factors" its broadest reasonable interpretation. In WFP, the system 
identifies the version of the file to determine if corrective action is necessary 
- a process that fully meets limitation (a) in claim 1 . 

Second, the limitation calling for "monitoring requests to write to files 
on the computer" is fully met by the computer's operating system in WFP. 
We agree with the Examiner that write requests occur in the system when 
files are modified. Significantly, the monitoring limitation in claim 1 does 
not specify which requests to write to files are monitored. As such, the 
limitation reads on essentially any computer operating system that inherently 
"monitors" write requests associated with modifying any files on the 
computer - including the protected files in WFP. 

Third, the limitation calling for "conditionally preventing the writes to 
the files on the computer based on the factors to prevent virus proliferation" 
is fully met by WFP.^ In this regard, we note that WFP's system replaces 
the file if the version is not the correct version (WFP, last two lines of P. 1). 
That is, WFP will not replace the file if it is the correct version. In this 
situation, WFP in effect conditionally prevents writing to the file based at 
least in part on the "factors" - namely, the version of the file identified as 
correct. 

Fourth, the limitation calling for altering the factors based on the 
monitoring of the requests is also fully met by WFP. If the new file is not 



^ We note in passing that the limitation "to prevent virus proliferation" 
merely recites a desired result intended to be achieved from the conditional 
prevention step. Such a desired result, however, does not patentably 
distinguish over the system of WFP notwithstanding the Examiner's reliance 
on the secondary reference to Rickey to show viruses can enter a system via 
critical files. 
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the correct version, the file is replaced. The very act of replacing the file in 
this manner would cause the system to inherently generate an associated 
request to write to the file - a write request that likewise is inherently 
monitored by the computer's operating system. Restoring the file to the 
correct version both alters and updates the factors (particular file versions in 
WFP) based, at least in part, on the operating system's monitoring the 
requests to write to the files and the requests themselves. 

For at least these reasons, we find that WFP actually anticipates 
representative claim 1. Nevertheless, obviousness rejections can be based 
on references that happen to anticipate the claimed subject matter. In re 
Meyer, 599 F.2d 1026, 1031, 202 USPQ 175, 179 (CCPA 1979). 
Furthermore, we sustain the Examiner's obviousness rejection based on the 
teachings of WFP alone since we may rely on fewer references than the 
Examiner in affirming a multiple-reference rejection under 35 U.S.C. § 103. 
InreBush. 296 F.2d491, 496, 131 USPQ 263, 266-67 (CCPA 1961); /« re 
Boyer, 363 F.2d 455, 458 n.2, 150 USPQ 441, 444 n.2 (CCPA 1966).^ 

Therefore, we will sustain the Examiner's rejection of representative 
claim 1. Likewise, we will sustain the Examiner's rejection of claims 2, 4-7, 
13-15, 17-20, 26, and 27 as they fall with representative claim 1. See 37 
C.F.R. §41.37(c)(l)(vii). 

Regarding claim 28, Appellants argue that restoring protected system 
files fi-om a cache or installation media after the files are modified does not 
teach or suggest looking up at least one of critical files and file locations 

^ Notwithstanding this conclusion, we nevertheless agree with the Examiner 
that the teachings of Rickey would have been reasonably combinable with 
WFP essentially for the reasons stated by the Examiner. The propriety of 
combining the teachings of Rickey with those of WFP has not been rebutted. 
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based on requests to write to the files or file locations (Br. 10-11; Reply Br. 
5-6). The Examiner argues that when the file is modified to an incorrect 
version in WFP, the correct version is looked up and the incorrect file 
version replaced with the correct version. According to the Examiner, the 
look up is therefore based on the request to write as claimed (Answer 8-9). 

We will sustain the Examiner's rejection of claim 28. Here again, the 
scope and breadth of the claim language does not preclude the disclosure of 
WFP. We note that WFP actually performs at least two "look ups" giving 
the term its broadest reasonable interpretation: (1) a look up of the file 
signature in a catalog to determine if the file is the correct version, and (2) if 
the file needs to be replaced, the correct file version is inherently "looked 
up" fi-om the Dllcache folder or installation media as appropriate. See WFP, 
last three lines of P. 1 through P. 2, 1. 1. Simply put, retrieving the correct 
file version fi-om either the Dllcache folder or the installation media 
inherently involves looking up the file. 

With this interpretation, we note that claim 28 merely broadly recites 
that critical files and/or critical file locations are looked up based on requests 
to write to the critical files and/or file locations. Given the broad scope of 
this limitation, either of the two "look ups" in WFP noted above is based, at 
least in part, on requests to write to the critical files. Although both lookups 
in WFP noted above occur after modification of the file as Appellants 
indicate, the lookups are nevertheless responsive to modification of the 
files-a modification that necessarily involves an associated write request. 

While WFP indicates that critical files can be modified and replaced 
with correct file versions, WFP nevertheless also prevents writes to critical 
files as claimed in the preamble. As we indicated previously, WFP will not 
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replace the file if it is the correct version.^ In this condition, writes to critical 
files are prevented thus fiilly meeting the limitation. We reach this 
conclusion emphasizing that the claim simply does not specify which writes 
are being prevented. Nor does the claim specify which request to write 
forms the basis for the look up. 

For the foregoing reasons, we find WFP actually anticipates claim 28. 
Nevertheless, as we indicated in connection with claim 1, we will sustain the 
Examiner's obviousness rejection based solely on WFP.^ 

We will also sustain the Examiner's rejection of claims 3 and 16.^ 
Although we find the Examiner's rationale pertaining to adjusting the cache 
size on P. 9 of the Answer problematic essentially for the reasons noted by 
Appellants (Reply Br. 7), we nevertheless find that WFP anticipates the 
claim giving the term "user configurable" its broadest reasonable 
interpretation. As we indicated previously, the claimed factors correspond 
to particular file versions in WFP."' Not only can the files themselves be 
configured by the user (e.g., by updating the files), but also the attributes 
associated with the particular files can be so configured. Appellants' 
arguments are simply not commensurate with the scope of representative 
claim 3. 

Although WFP actually anticipates claim 3, we will nevertheless 
sustain the Examiner's obviousness rejection based solely on WFP for the 



See P. 6, supra, of this opinion. 
^ See id. at 6-7. 

^ Appellants indicate that claims 3 and 16 correspond to Group #3 (Br. 1 1). 
Accordingly, we select claim 3 as representative of this group. 
See P. 5, supra, of this opinion. 



9 



Appeal 2007-0956 
Application 10/028,651 

reasons noted previously. ' ' Likewise, we will sustain the Examiner's 
rejection of claim 1 6 which falls with representative claim 3 . 

Regarding claims 9, 10, 22, and 23,'^ Appellants argue that WFP does 
not teach or suggest updating factors as claimed, but merely repairs incorrect 
file versions. Appellants also argue that WFP only responds to 
modifications of files and not to requests as claimed (Br. 12; Reply Br. 8). 

The Examiner argues that the administrator's ability to scan all 
protected files to verify their versions in the System File Checker tool in 
WFP corresponds to a user request to determine whether a file has been 
modified. The Examiner adds that replacing the file to the correct version if 
the file is modified corresponds to updating the file. The Examiner also 
notes that such file updates can be implemented from a cache via a local 
path or a network (Answer 9-10). 

We will sustain the Examiner's rejection of representative claim 9. 
We agree with the Examiner that the administrator's ability in WFP to scan 
the protected files to verify their versions and replace modified files 
reasonably corresponds to updating the factors (i.e., particular file versions) 
based on a user request as claimed. Moreover, regarding claim 10, we agree 
with the Examiner that these updates from the Dllcache can be via a network 
path (WFP, at 3). Appellants' arguments are simply not commensurate with 
the scope of the claims. 

Although WFP actually anticipates claims 9 and 10, we will 
nevertheless sustain the Examiner's obviousness rejection based solely on 



" See id. at 6-7. 

Appellants indicate that claims 9, 10, 22, and 23 correspond to Group #4 
(Br. 12). Accordingly, we select claim 9 as representative of this group. 
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WFP for the reasons noted previously.'^ Likewise, we sustain the 
Examiner's rejection of claims 22 and 23 for similar reasons. 

Regarding claims 12 and 25,'"* Appellants argue that WFP's 
prompting the administrator to insert media to replace the file does not teach 
or suggest conditionally preventing writes to the files based on a user 
confirmation as claimed. Appellants emphasize that if WFP prevented 
writing to the file, there would be no need to replace the file (Br. 12-13; 
Reply Br. 9-10). The Examiner argues that 'Hiser confirmation" occurs when 
the user inserts media to replace the file. The Examiner adds that since the 
correct version is copied fi-om the media in this instance, such action 
therefore prevents writing to the file with the incorrect version (Answer 10). 

We will sustain the Examiner's rejection of claims 12 and 25. We 
reiterate at the outset that claim 12, like claim 1, does not specify which 
writes to the files are being prevented. Thus, the scope and breadth of the 
claim simply does not preclude preventing either unauthorized or authorized 
writes. 

With this interpretation, we tum to WFP. First, we agree with the 
Examiner that that "user confirmation" occurs when the user in WFP inserts 
media to replace the file. Second, as we indicated in connection with claim 
1, WFP's system replaces the file if the version is not the correct version 
(WFP, last two lines of P. 1). That is, WFP will not replace the file if it is 
the correct version. In this situation, WFP in effect conditionally prevents 
writing to the file (correct version) which is based, at least in some instances. 



'"^ See P. 6-7, supra, of this opinion. 

Appellants indicate that claims 12 and 25 correspond to Group #5 (Br. 
12). Accordingly, we select claim 12 as representative of this group. 
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on a file that was copied from the inserted media (i.e., based at least in part 
on a "user confirmation"). Claim 12 is therefore fiiUy met by WFP. 

Although WFP actually anticipates claim 12, we will nevertheless 
sustain the Examiner's obviousness rejection based solely on WFP for the 
reasons noted previously.'^ We also sustain the rejection of claim 25 for 
similar reasons. 

Regarding claim 30, Appellants argue, among other things, that 
WFP's updating a file in a cache fails to suggest that a list of critical files is 
updated based on the requests as claimed (Br. 13; Reply Br. 10-11). The 
Examiner argues that when the cache in WFP does not hold all critical files, 
and a critical file is modified that is not on the list, media is inserted that 
effectively updates the Hst (Answer 10-11). 

We will sustain the Examiner's rejection of claim 30. We note that 
the scope and breadth of the claim does not preclude the multiple critical 
files that are contained in the system of WFP which collectively constitute a 
list. Since at least one file of the collection of critical files is updated 
responsive to a file modification (write requests), the list is effectively 
updated based at least in part on the write requests. The claim is therefore 
fiiUy met by WFP. Although we find WFP anticipates claim 30, we will 
nonetheless sustain the Examiner's obviousness rejection of claim 30 for the 
reasons previously discussed.'^ 

We next consider the Examiner's rejection of claims 8, 21, and 3 1 
under 35 U.S.C. § 103(a) as unpatentable over WFP in view of Rickey and 



See P. 6-7, supra, of this opinion. 
See id. 
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further in view of Stevens. Regarding claims 8 and 21,'^ the Examiner finds 
that the prior art discloses all of the claimed limitations except for the factors 
to include trusted applications that initiate the requests. The Examiner cites 
Stevens as teaching trusted apphcations and concludes that it would have 
been obvious to one of ordinary skill in the art at the time of the invention to 
use a trusted application in the prior art file protection system to allow 
trusted applications to access protected information (Answer 5-6). 
Appellants argue that Stevens does not disclose that a trusted application 
initiates the requests where the requests write to files on the computer (Br. 
14; Reply Br. 12). 

We will sustain the Examiner's rejection of claims 8 and 21 . We note 
at the outset that essentially any computer file write requests effectively are 
initiated within the computer's operating system and therefore are initiated 
by "trusted applications" giving the term its broadest reasonable 
interpretation. For this reason alone, we find that WFP actually anticipates 
representative claim 8. We add that the replacing a file with the correct 
version in WFP would likewise cause the computer's operating system to 
inherently generate an associated request to write to the file - a write request 
that is initiated by a "trusted applications" (i.e., the computer's operating 
system) giving the term its broadest reasonable interpretation. 

Although we find that WFP actually anticipates claim 8, we will 
nevertheless sustain the Examiner's obviousness rejection based solely on 



1 7 

Appellants indicate that claims 8 and 21 correspond to Group #1 of Issue 
#2 (Br. 1 1). Accordingly, we select claim 8 as representative of this group. 
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WFP for the reasons noted previously.'^ We also sustain the rejection of 
claim 21 for similar reasons. 

We will not, however, sustain the Examiner's rejection of claim 31. 
The claim requires (1) alerting the user when one of the requests is initiated 
by an application that is not one of the trusted applications, and (2) allowing 
the user to prevent and/or permit the request. Although WFP alerts the user 
when the file is modified, and Stevens generally teaches allowing trusted 
applications access to protected areas of computer as the Examiner indicates 
(Answer 1 1), we do not agree that these collective teachings reasonably 
teach or suggest alerting the user specifically when a request is initiated by 
an untrusted application, and then allowing the user to prevent and/or permit 
the request as claimed. In essence, the claim requires some degree of user 
intervention with respect to the request itself 

Although the user in WFP is certainly alerted if a file has been 
changed to an incorrect version, the user is simply not allowed to prevent 
and/or permit the request that was initiated by the application. Even if the 
file was modified by an unauthorized source, the very act of modifying the 
file necessarily resulted in the write request being automatically permitted 
without user intervention. 

For the foregoing reasons, we will not sustain the Examiner's 
rejection of claim 3 1 . 

DECISION 

We have sustained the Examiner's rejections with respect to claims 1- 
10, 12-23, 25-28, and 30. We have not, however, sustained the Examiner's 

See P. 6-7, supra, of this opinion. 
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rejection with respect to claim 31. Therefore, the Examiner's decision 
rejecting claims 1-10, 12-23, 25-28, 30, and 31 is affirmed-in-part.'^ 

No time period for taking any subsequent action in connection with 
this appeal may be extended under 37 C.F.R. § L136(a)(l)(iv). 

AFFIRMED-IN-PART 

KIS 

ZILKA-KOTAB, PC 

P.O. BOX 721 120 

SAN JOSE, CA 95172-1 120 



Although not before us on appeal, we note that at least independent claims 
14 and 27 raise issues regarding whether the claims recite statutory subject 
matter under 35 U.S. C. § 101. For the reasons below, the Examiner should 
consider whether at least these claims recite statutory subject matter. 

Claim 14, for example, recites a "computer program product" with three 
"computer code" limitations and limitations directed to alerting and updating 
the claimed factors. Similarly, claim 27 recites three "logic" limitations with 
commensurate limitations directed to alerting and updating the claimed 
factors. 

Significantly, however, no computer-readable medium is recited in either 
claim. In effect, the claims appear to recite mere fimctional descriptive 
material that, without more, constitutes nonstatutory subject matter. 

If, however, such functional descriptive material is recorded on a computer- 
readable medium, "it becomes structurally and fiinctionally interrelated to 
the medium and will be statutory in most cases since use of technology 
permits the function of the descriptive material to be realized."). See MPEP 
§2106.01. 
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